Data Processing Agreement

Version 1.0Effective 9 July 2026Last updated 14 August 2026

Effective 9 July 2026

This Data Processing Agreement ("DPA") forms part of the agreement between the Customer ("Controller") and Safe Welkin Limited ("Processor") for use of the DeCompass Platform and reflects the parties' obligations under Article 28 of the UK GDPR.

1. Roles

The Customer is the controller and Safe Welkin Limited is the processor of Customer Personal Data processed through the Platform. Each party will comply with applicable data protection law.

2. Scope and instructions

Safe Welkin Limited will process Customer Personal Data only on the Customer's documented instructions (including as set out in the Terms and this DPA), except where required by law.

3. Subject-matter and details of processing

Item	Detail
Subject-matter	Provision of the DeCompass compliance platform
Duration	For the term of the subscription plus retention periods
Nature & purpose	Hosting, storage, analysis and processing to deliver compliance features
Categories of data subjects	Customer's staff, contractors, customers, external auditors and other individuals in Customer Data
Categories of personal data	Identifiers, contact details, employment data, and any data the Customer chooses to upload

4. Security measures

Safe Welkin Limited implements appropriate technical and organisational measures aligned with ISO/IEC 27001, including: encryption in transit (TLS 1.2+) and at rest; role-based access control and least privilege; secrets management and key rotation; network segmentation; logging, monitoring and alerting; regular vulnerability scanning and penetration testing; and secure software development practices. Full details are in our Information Security Statement.

5. Confidentiality

Personnel authorised to process Customer Personal Data are bound by confidentiality obligations.

6. Sub-processors

The Customer authorises Safe Welkin Limited to engage the sub-processors listed on our Sub-processors page. We impose data protection terms on each sub-processor no less protective than this DPA and remain liable for their performance. We will give notice of new sub-processors and a reasonable opportunity to object.

7. Data subject rights & assistance

Taking into account the nature of processing, Safe Welkin Limited will assist the Customer with data subject requests and with obligations under Articles 32–36 (security, breach notification and impact assessments).

8. Personal data breaches

Safe Welkin Limited will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available.

9. International transfers

Where processing involves a transfer outside the UK, the parties will rely on the UK IDTA / Standard Contractual Clauses and appropriate safeguards.

10. Return and deletion

On termination, Safe Welkin Limited will, at the Customer's choice, return or delete Customer Personal Data (subject to legal retention requirements) within the periods set out in our Data Retention & Deletion Policy.

11. Audit

Safe Welkin Limited will make available information necessary to demonstrate compliance and allow for audits, including through third-party certifications and reports, subject to reasonable confidentiality and frequency limits.

12. Contact

Data protection queries: [email protected].